[2.1] Backport #3075 - Add check, if Offset is greater then stream length when reading bitmap colorMapSize

.github/workflows/build-and-test.yml

@@ -22,7 +22,7 @@ jobs:
             sdk-preview: true
             runtime: -x64
             codecov: false
-          - os: macos-13 # macos-latest runs on arm64 runners
+          - os: macos-26-intel
             framework: net6.0
             sdk: 6.0.x
             sdk-preview: true
@@ -38,7 +38,7 @@ jobs:
             framework: net5.0
             runtime: -x64
             codecov: false
-          - os: macos-13 # macos-latest runs on arm64 runners
+          - os: macos-26-intel
             framework: net5.0
             runtime: -x64
             codecov: false
@@ -50,7 +50,7 @@ jobs:
             framework: netcoreapp3.1
             runtime: -x64
             codecov: false
-          - os: macos-13 # macos-latest runs on arm64 runners
+          - os: macos-26-intel
             framework: netcoreapp3.1
             runtime: -x64
             codecov: false
@@ -77,11 +77,12 @@ jobs:
       - name: Install Ubuntu prerequisites
         if: ${{ contains(matrix.options.os, 'ubuntu') }}
         run: |
-          # libssl 1.1 (required by old .NET runtimes)
-          wget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.0g-2ubuntu4_amd64.deb
-          sudo dpkg -i libssl1.1_1.1.0g-2ubuntu4_amd64.deb
+          # libssl 1.1 (required by old .NET runtimes, not in Ubuntu 22.04+ repos)
+          wget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb
+          sudo dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb
 
           # libgdiplus
+          sudo apt-get update
           sudo apt-get -y install libgdiplus libgif-dev libglib2.0-dev libcairo2-dev libtiff-dev libexif-dev
 
       - name: Git Config

src/ImageSharp/Formats/Bmp/BmpDecoderCore.cs

@@ -1377,6 +1377,12 @@ private int ReadImageHeaders(BufferedReadStream stream, out bool inverted, out b
                     switch (this.fileMarkerType)
                     {
                         case BmpFileMarkerType.Bitmap:
+                            if (this.fileHeader.Offset > stream.Length)
+                            {
+                                BmpThrowHelper.ThrowInvalidImageContentException(
+                                    $"Pixel data offset {this.fileHeader.Offset} exceeds file size {stream.Length}.");
+                            }
+
                             colorMapSizeBytes = this.fileHeader.Offset - BmpFileHeader.Size - this.infoHeader.HeaderSize;
                             int colorCountForBitDepth = ColorNumerics.GetColorCountForBitDepth(this.infoHeader.BitsPerPixel);
                             bytesPerColorMapEntry = colorMapSizeBytes / colorCountForBitDepth;

tests/ImageSharp.Tests/Formats/Bmp/BmpDecoderTests.cs

@@ -632,5 +632,33 @@ public void BmpDecoder_ThrowsException_Issue2696<TPixel>(TestImageProvider<TPixe
                     using Image<TPixel> image = provider.GetImage(BmpDecoder);
                 });
         }
+
+        // https://github.com/SixLabors/ImageSharp/issues/3074
+        [Fact]
+        public void BmpDecoder_ThrowsException_Issue3074()
+        {
+            // Crafted BMP: pixel data offset = 0x7FFFFFFF, actual file = 35 bytes
+            byte[] data =
+            {
+                0x42, 0x4D,                         // "BM" signature
+                0x3A, 0x00, 0x00, 0x00,             // file size: 58
+                0x00, 0x00, 0x00, 0x00,             // reserved
+                0xFF, 0xFF, 0xFF, 0x7F,             // pixel offset: 0x7FFFFFFF (2,147,483,647)
+                0x28, 0x00, 0x00, 0x00,             // DIB header size: 40
+                0x01, 0x00, 0x00, 0x00,             // width: 1
+                0x01, 0xFF, 0x00, 0x00,             // height: 65281
+                0x01, 0x00,                         // color planes: 1
+                0x08, 0x00,                         // bits per pixel: 8
+                0x00, 0x00, 0x00, 0x00,             // compression: RGB
+                0x00, 0x00, 0x00 // (truncated)
+            };
+
+            using MemoryStream stream = new(data);
+
+            Assert.Throws<InvalidImageContentException>(() =>
+            {
+                using Image<Rgba32> image = Image.Load<Rgba32>(stream);
+            });
+        }
     }
 }